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(57) Abstract 

A watchdog circuit (42, 54) accepts an output signal (WDIN) from a monitored circuit such as a microprocessor to determine whether 
the monitored circuit is operating appropriately or has incurred an error. The monitored circuit must periodically assert the output signal to 
prevent the watchdog circuit, which imposes both upper and lower frequency bounds on the assertion of this signal from setting a watchdog 
error alarm (WDERR). 
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A WATCHDOG CIRCUIT EMPLOYING MINIMUM AND MAXIMUM 
INTERVAL DETECTORS 



BACKGROUND QF THE INVENTION 

Field of the Invention 

The invention is related to microprocessor supervisory 
circuits and, in particular, to microprocessor * watchdog" 
5 circuits . 

Desr.ripr.1on of the Related Art 

Digital controllers such as microprocessors control 
instrumentation, computers, and automotive systems, to name 
just a few areas of application. Proper operation of the 

10 microprocessors in control of these applications is 
imperative. Improper operation could cause costly and, in 
some cases, life-threatening mistakes. If, for example, a 
system "glitch" causes a microprocessor to jump to an 
improper address, the microprocessor could interpret data 

15 as instructions and proceed to haphazardly overwrite 
critical life support data in an instrumentation 
application, to miscue an automatic braking system in an 
automotive application, or to destroy valuable stock- 
trading information in a computer application. 

20 A microprocessor may be misdirected, as in the above 

examples, by a hardware failure initiated by radio 
frequency interference, by an electrostatic discharge, by 
mechanical failure such as a "cold" solder joint, or by a 
momentary power loss which corrupts the microprocessor's 

25 instructions. Software errors may also cause a 

microprocessor to *go south", getting stuck in an infinite 
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loop (repeatedly executing the same instructions) , for 
example . Because of the hazards associated with such 
microprocessor errors and the very real threat of their 
occurrence, supervisory circuits which include "watchdogs" 
5 have been developed and are widely employed within 
microprocessor-based circuits. Much as a referee might ask 
a boxer n how many fingers", a watchdog requires an 
associated microprocessor to occasionally assert a signal 
in order to assure the watchdog that the microprocessor has 

10 not entered an infinite loop, or is otherwise operating 
incoherently. Watchdogs are discussed in Stephen Savitsky, 
Real-Time Micro processor Systems . Van Nostrand Reinhold, 
New York, 1989, page 80. 

The block diagram of FIG.l illustrates a conventional 

15 watchdog 10 . The watchdog 10 includes a counter 12 that is 
connected to count pulses from a clock 14 . The counter 12 
includes a reset input 16 which resets the counter to zero 
when asserted. The watchdog includes an input 18 connected 
to receive a signal, here labeled WDIN, from a 

20 microprocessor that is being monitored by the watchdog 10. 
During normal operation, i.e., after a system which employs 
the watchdog 10 has completed a power-up sequence and all 
inputs and outputs are generally assumed to be valid, the 
counter 12 begins to count output pulses from the clock 14 . 

25 Should the counter reach a preset count, which corresponds 
with a prescribed maximum time interval, the counter 
asserts the watchdog output 20, labeled ALARM. The 
assertion of this signal by the watchdog may be employed by 
other circuitry, including the monitored microprocessor, to 

30 initiate a system reset (either hardware or software) , for 
example. Therefore, in order to maintain its operational 
sequence, the microprocessor must regularly assert WDIN, 
thereby resetting the counter 12 preventing assertion of 
the ALARM signal. This provides some assurance that the 

35 microprocessor is not executing an infinite loop or is 
otherwise "distracted" . 
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Watchdog circuits such as the one described in 
relation to FIG.l are sometimes combined with other 
circuits to form a supervisory circuit such as the 
supervisory circuit 22 of PIG. 2. As discussed in relation 
5 to FIG.l, the watchdog circuit 10 monitors the input 18 and 
asserts the ALARM signal at output 20, which is connected 
to a reset generator 21, whenever the maximum prescribed 
interval between assertions of WDIN is exceeded. A 
comparator 24 compares a voltage VI at its inverting input 

10 to a signal PWRFLI at its noninverting input and produces 
a power failure output signal PWRFLO. The signal PWRFLI 
represents the circuit's positive supply voltage and, 
whenever it falls below the level of VI, the comparator 
asserts the power failure output signal PWRFLO , indicating 

15 that the positive supply has fallen below a preset value. 
Another comparator 26 is connected at its inverting and 
noninverting inputs to positive supply voltage VCC and 
battery voltage VBATT, respectively. The comparator 26 
controls a switch 28 which connects either VBATT or VCC to 

20 a power output VOUT. Whenever VBATT is greater than VCC, 
VBATT is connected, through the switch 28, to VOUT. 
Conversely, whenever VCC is greater than VBATT, VCC is 
connected through the switch 28 to VOUT. 

Additionally, a comparator 30 is connected to a 

25 voltage reference V2 and to the positive supply voltage VCC 
at its inverting and noninverting inputs, respectively. 
Whenever the positive supply voltage drops below the level 
of V2, the comparator 30 sends a negative signal to the 
reset generator 21. In this case, the reset generator 21 

30 may activate the signal RESET available at an output 32, to 
reset the system because, even though VOUT has been 
switched to VBATT, there may have been some disruption to 
the circuit when VCC fell below V2. The reset generator 21 
may also include power- on- reset circuitry to ensure that 

35 circuitry which relies upon the RESET signal is not 
permitted to commence operation until after the positive 



WO 97/32282 



PCT/US97/03407 



4 



power supply voltage VCC has reached a prescribed safe 
operating level. 

Although the watchdog 20 ensures that an associated 
microprocessor is sufficiently operational to assert the 
WDIN signal periodically, there are failure mechanisms that 
would allow the microprocessor to assert WDIN signal with 
sufficient frequency to satisfy the watchdog requirement, 
even though the microprocessor is "lost" . For example, the 
microprocessor may, through random operation or by virtue 
of being stuck in a loop, continuously assert WDIN every 
instruction cycle, 

SUMMARY O F THE INVENTION 

The invention is directed to a watchdog circuit that 
reduces the likelihood that a monitored circuit such as a 
microprocessor could, in spite of errant operation, fail to 
trigger the watchdog circuit. The new watchdog circuit 
includes a minimum interval detector in addition to a 
maximum interval detector. The interval detectors, in 
combination, impose both upper and lower bounds upon the 
frequency with which a microprocessor must assert a 
watchdog signal to prevent a watchdog alarm. The minimum 
and maximum interval detectors may be combined in a variety 
of ways . The watchdog input signal could be routed to both 
detectors in parallel, with their outputs combined to 
create a watchdog alarm or the input signal could be routed 
first to the maximum interval detector, then to the minimum 
interval detector to create the watchdog alarm. In the 
preferred embodiment, the watchdog inputf signal is routed 
in sequence to the minimum interval detector and, from 
there, to the maximum interval detector. 

The new watchdog circuit requires a monitored circuit, 
e.g., a microprocessor, to periodically assert a watchdog 
input signal to prevent the watchdog from activating an 
alarm. An assertion of the watchdog input signal is routed 
to a minimum interval detector where it initiates a minimum 
interval counter. If, at the end of the minimum interval, 
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no further assertions of the watchdog input signal have 
taken place, the transition is passed to the maximum 
interval detector. On the other hand, every subsequent 
assertion of the watchdog input prior to the end of the 
minimum interval resets the counter and prevents passage of 
any assertion on to the maximum interval detector. The 
maximum interval detector independently measures a maximum 
interval and, when that interval is reached, activates the 
watchdog alarm signal. However, if an assertion is passed 
from the minimum interval detector to the maximum interval 
detector, the maximum interval detector is reset, thus 
preventing assertion of the alarm output. Thus, if the 
watchdog input is asserted either too frequently or not 
frequently enough, the watchdog circuit asserts the alarm 
signal. 

In a preferred embodiment, the watchdog circuit is 
combined with voltage regulators and a reset circuit to 
form a supervisory circuit. Additionally, a single clock 
provides pulses to both the minimum and maximum interval 
detectors. This reduces the amount of trimming ^required 
because only one clock need be trimmed, rather than two. 
These and other features, aspects and advantages of the 
invention will be apparent to those skilled in the art from 
the following detailed description, taken together with the 
accompanying drawings. 
BRIEF DESCRIPTION OF THE DRAWINGS 

FIG.l is a block diagram which illustrates the basic 
components of a conventional watchdog circuit . 
FIG. 2 is a block diagram illustrating a conventional 
supervisory circuit which incorporates a watchdog circuit, 
power failure sensing, and power switching into one device. 
FIG.3A is a block diagram of a parallel implementation of 
the novel watchdog circuit. 

FIG.3B is a block diagram which illustrates a series 

implementation of the new watchdog circuit, 

FIG.3C illustrates an alternative series implementation of 
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the new watchdog circuit. 

FIG. 4 illustrates the interconnection of the major 
components of the new watchdog circuit. 

PIG. 5 is a more detailed functional diagram of the new 
5 watchdog circuit of FIG. 3. 

FIG. 6 illustrates a new supervisory circuit which includes 
the watchdog circuit of FIG. 3 

FIG. 7 is a block diagram of an automotive microprocessor- 
based control system which employs the new watchdog circuit 
10 as a part of a supervisory circuit. 

DETAILED DESCRIPTION OF THE INVENTION 

The new watchdog circuit 33 illustrated in the block 
diagrams of FIGs 3A-3B includes a maximum interval detector 
34 and a minimum interval detector 42. In the 

15 implementation of FIG.3A, the minimum interval detector 42 
and maximum interval detector 34 receive a watchdog input 
signal WDIN in parallel. The respective outputs of the 
minimum interval detector 42 and maximum interval detector 
34 are combined in a combiner 35 to create an alarm output 

20 signal ALARM. The alarm signal ALARM is activated whenever 
assertions of WDIN are out-of -range, i.e., whenever they 
occur too frequently or too infrequently. In the embodiment 
of FIG.3B, the signal WDIN is routed in sequence to the 
minimum interval detector 42, then to the maximum interval 

25 detector 34 to create the alarm signal ALARM. Again, 
whenever assertions of WDIN are out -of -range, the watchdog 
circuit 33 asserts the signal ALARM . The embodiment of 
FIG.3C routes the WDIN signal to the maximum interval 
detector 34 then to the minimum interval detector 34 which 

30 asserts the signal ALARM whenever assertions of WDIN are 
out -of -range. 

The new watchdog circuit 33 illustrated in the block 
diagram of FIG. 4 includes a maximum interval detector 34 
which is connected to receive pulses from a clock 36. 
35 After being reset, the detector 34 counts clock pulses and, 
if it reaches a predetermined maximum count corresponding 
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to a maximum prescribed interval, it activates a signal 
ALARM which is available at the watchdog output 38. To 
prevent the watchdog from activating ALARM, a monitored 
circuit must reset the maximum interval detector before it 
reaches the maximum count. To this end, an input 40 is 
provided to receive a watchdog input signal WDIN. The 
input 40 is connected to a minimum interval detector 42 
which also receives clock pulses from the clock 36. 

The minimum interval detector 42 operates to limit the 
frequency with which a monitored circuit may validly assert 
the WDIN signal. In effect, once the minimum interval 
detector determines that WDIN has been asserted, it "holds" 
this assertion for a predetermined period of time. If, 
during this period of time there are no further assertions 
of WDIN, the minimum interval detector allows the next 
assertion of WDIN to pass to the maximum interval detector, 
thereby resetting the maximum interval detector and 
blocking assertion of ALARM. Only those assertions of WDIN 
which are spaced at least the minimum interval apart from 
the immediately preceding assertion are passed on to reset 
the maximum interval detector. By imposing both minimum 
and maximum interval requirements on the assertion of the 
watchdog input signal WDIN, the circuit substantially 
reduces the likelihood that a "berserk", i.e., improperly 
operating, microprocessor could continue to operate. For 
example, a microprocessor could be stuck in a loop in which 
it asserts the watchdog input every fourth clock cycle. If 
the minimum interval is ten clock cycles, the 
microprocessor's "mindless" assertion of WDIN will not be 
mistaken for a valid assertion of the signal and the 
watchdog output signal ALARM will be asserted. 
Additionally, random assertions of the watchdog input 
signal WDIN which occur frequently enough to satisfy the 
maximum interval requirement may occur too frequently to 
satisfy the minimum interval requirement, and therefore 
will not be passed on to the maximum interval detector. In 
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this preferred embodiment, the minimum interval detector 42 
does not activate ALARM every time assertions of WDIN 
violate the minimum interval requirement, rather, in those 
cases, it blocks passage of WDIN assertions to the maximum 
5 interval detector 34 . 

In a preferred implementation, the watchdog circuit 33 
is combined with other circuitry in a single integrated 
circuit. In such an implementation it is advantageous to 
employ a single clock,, such as the clock 36, to supply both 

10 the minimum and maximum interval detectors 42 and 34, 
respectively. This reduces the clock adjustment process to 
a single laser- trimming step. The maximum and minimum 
intervals may be adjusted, for example, by adjusting the 
clock frequency. The maximum interval should be set so as 

15 to minimize the damage caused by a runaway microprocessor, 
and the minimum interval should be set with the 
microprocessor's operating speed in mind. If, for example, 
the monitored microprocessor requires four instructions of 
two clock cycles apiece to assert the WDIN signal, the 

20 minimum interval should be at least 2*4*2 clock cycles long 
in order to be effective. The microprocessor clock cycles 
may or may not equal the clock cycles of the watchdog clock 
36/ the minimum and maximum intervals used to test WDIN are 
adjusted to compensate for any differences between the 

25 microprocessor and watchdog clocks. Although the 
illustrated preferred embodiment of the watchdog circuit 
includes a clock, an external clock may be employed in the 
alternative . 

The block diagram of FIG. 5 provides more details of 
30 the minimum interval detector 42 and the maximum interval 
detector 34. Beginning with an analysis of the minimum 
interval detector, three shifters SHIFTi, SHIFT2 and SHIFT3 
that shift the WDIN signal into the circuit are connected 
at their clock inputs CK1, CK2 and CK3 , respectively, to a 
35 clock signal CK. A counter 44 also has its clock input CK4 
connected to receive and to count pulses in the clock 
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signal CK. The shifters SHIFT1, SHIFT2 and SHIFT3 also 
feature data inputs Dl f D2 and D3, and data outputs 01, Q2 
and Q3, respectively. The data input Dl is connected to 
receive the watchdog input signal WDIN at an input 40 . The 
5 output Ql is connected to the input D2 and the output Q2 is 
connected to the input D3 . In a preferred embodiment the 
shifters SHIFT1, SHIFT2 , and SHIFT3 are implemented as D 
type flip-flops. The watchdog input WDIN is successively 
shifted through the shifters SHIFT1, SHIFT2 and SHIFT3 by 
10 the respective clock inputs CK1, CK2 and CK3 so that a 
transition in the signal WDIN appearing at the watchdog 
input 40 will appear at the output Ql after one clock 
cycle, at the output Q2 after two clock cycles, and at the 
output Q3 after three clock cycles. 
15 Difference detectors DIFF1 and DIFF2 are connected to 

detect differences between outputs Ql and Q2 and between 
outputs Q2 and Q3, respectively. In a preferred 
embodiment, the difference detectors DIFF1 and DIFF2 are 
implemented as EXCLUSIVE NOR gates. As a state change in 
20 the watchdog input signal WDIN is shifted through the 
shifters SHIFT1 - SHIFT3 , the difference detectors DIFF1 and 
DIFF2 will detect this change in state sequentially, i.e., 
DIFFl will detect the transition at its inputs A and B and 
modify its output C to reflect the change, and subsequently 
25 DIFF2 will detect the transition at its inputs D and E and 
modify its output F accordingly. The output F of 
difference detector DIFF2 is connected to the reset input 
Rl of a counter 44. Whenever the difference detector DIFF2 
detects a transition in the WDIN signal, i.e., whenever the 
30 signals at its E and D inputs differ, it resets the counter 
44 and a set/reset/and (SRAND) gating block 46 . 

In the preferred embodiment, the SRAND gating block 46 
includes a set/reset (SR) latch 48 and an AND gate 50 . The 
SR latch has inputs SI and R2 and an output Q4 which is 
35 connected to one input of an AND gate 50. The AND gate 50 
acts to gate the output from the difference detector DIFFl. 
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When the counter "times out", i.e., reaches its prescribed 
count, it sets the latch 48, thus placing a logic n l" at 
the active high output Q4 and allowing the transfer of a 
logic "1" through the AND gate 50. Conversely, until the 
5 detector times out, the SR latch 48 remains reset, 
providing a logic "0" at the AND gate and thereby 
"blocking" the transfer of a logic w l" . 

To aid in the understanding of the sequential 
operation of the minimum interval detector 42, first assume 

10 that the counter 44 has "timed out" and that the latch 
output Q4 is w l" (in order for these conditions to exist, 
their must have been a valid assertion of the watchdog 
input WDIN) . As a WDIN assertion shifts through shifters 
SHIFT1-SHIFT3, difference detector DIFFl will detect a 

15 difference between its inputs A and B and place a logic "1" 
at its output C. Since the other input to the AND gate 50 
is also at a logic "1" (the timed-out counter set the latch 
48), the output of the AND gate 50 is also a logic "1". As 
will be discussed in greater detail below, a logic "1" at 

20 this point resets the maximum interval detector, thereby 
preventing a watchdog alarm activation. 

Assuming now, contrary to the above example, that 
after the first valid assertion of WDIN the signal WDIN is 
asserted again before the counter 44 times out. In this 

25 case, as the assertion is shifted through the shifters 
SHIFT1-SHIFT3, the difference detector DIFFl will detect 
the transition and change the state of its signal at the 
output C to a logic "1" . However, since the counter 44 
will not have timed out, the latch 48 will remain 

30 reset (latch 48 is reset by DIFF2 at the same time it resets 
the counter 44) and block the transfer of logic M l". In 
this way, only assertions of the WDIN signal which are 
spaced at least the minimum interval apart are allowed to 
reset the maximum interval detector. 

35 A valid (properly timed) WDIN assertion will pass 

through the minimum interval detector 42 in the manner just 
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described and proceed to the maximum interval detector 34 
from the output of the SRAND gating block 46 to the input 
54 of the maximum interval detector, where the intermediate 
watchdog signal is given the label WD INT . The maximum 
interval detector 34 includes a counter 56 that is 
connected at its reset input R3 to Che input 54, and at its 
clock input CK5 to receive the clock signal CK, The 
u timeout" output TO of the counter 56 is connected to the 
set input S5 of a set/reset (SR) latch 58, The output Q5 
of the SR latch 58 is connected to the set input S6 of an 
SR latch 60, whose output Q6 provides the watchdog error 
signal WDERR at the output 38 of the watchdog circuit 33. 
Additionally, a pulse generator 62 is connected at its 
input 63 to the input 54 and generates a pulse in response 
to the assertion of WDINT, This pulse is passed along to 
the reset input R5 of the SR latch 58. An OR gate 64 is 
connected to logically OR the signal appearing at the input 
54 with that at the output Q5 of the latch 58. The output 
of the OR gate 64 is connected to the reset input R6 of the 
SR latch 60. 

In analyzing the maximum interval detector, first 
assume that the counter 56 has not *timed-out" and is 
counting toward its maximum prescribed count. An assertion 
of WDINT resets the counter 56 and, so long as the counter 
is continuously reset in this fashion, the counter 56 never 
times out and the watchdog error signal WDERR is never 
asserted. If, however, WDINT is not asserted before the 
counter 56 times out, the counter output TO sets the latch 
58 which, in turn, sets the latch 60, thereby activating 
the watchdog error signal WDERR. Assuming now that WDERR 
has been activated as just described, the counter time out 
output TO is active, and latches 58 and 60 are set. Until 
WDINT is asserted, the counter output TO and latch outputs 
Q5 and Q6 will remain set. When WDINT is asserted, the 
counter 56 will be reset. While the output TO could be 
employed as the watchdog output, in the preferred 
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embodiment the additional circuitry, including the pulse 
generator 62, OR gate 64 and SR latches 58 and 60, is 
employed to impose further restrictions upon a monitored 
circuit such as a microprocessor, thus further ensuring 
more coherent operation of the monitored circuit. 

The contribution of this "additional circuitry" is as 
follows. As noted above, assertion of WD INT resets the 
counter 56, thus releasing the set input S5 of SR latch 58. 
Additionally, assertion of WD INT causes the pulse generator 
62 to generate a pulse which arrives at the reset input R5 
after the counter 56 has released the set input S5 and, 
therefore, resets the SR latch 58. Since the SR latch 58 
is reset, the set input S6 of SR latch 60 is also released, 
enabling a negative input at the reset input R6 to reset 
the latch 60, thus de-asserting the watchdog error output 
WDERR. Turning now to the OR gate 64 which provides the 
input signal to R6, although the output Q5 is low after the 
pulse generator 62 resets the SR latch 58, the other input 
to the OR gate 64 is high by the time Q5 switches to a 
logic low, because the negative pulse which constitutes the 
assertion of WDINT is not delayed, as the pulse from the 
pulse generator 62 is. 

However, a subsequent valid assertion of WDINT before 
the counter times out will reset the latch 60, thereby de- 
asserting WDERR because the output Q5 will already be low, 
allowing the negative pulse of WDINT at the other input to 
the OR gate 64 to pass through and reset the SR latch 60 . 
By delaying the de-assertion of the WDERR signal in this 
fashion, the WDIN signal must be validly asserted at least 
twice within the maximum prescribed period before the WDERR 
signal is released, thus providing further assurance that 
a monitored circuit is operating coherently before it is 
allowed to proceed with other tasks. 

The new watchdog circuit 33 of FIG. 4 may be employed 
by a supervisory circuit 66 as illustrated in the block 
diagram of FIG. 6. The supervisory circuit 66 includes two 
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voltage regulators REG1 and REG2 which are connected to 
receive an unregulated positive input voltage V+ and to 
provide regulated output voltages at their respective 
outputs 68 and 70. One or the other of outputs 68 and 70 
5 are connected through a switch 72 to a regulated output 
voltage terminal 74 which provides a regulated output 
voltage VREG+ for use by other circuitry, such as a 
microprocessor (not shown) , monitored by the supervisory 
circuit 66. A comparator 76 is connected at its inverting 

10 and noninverting inputs to a voltage reference VREF and 
the regulated voltage output 68, respectively. The output 
of the comparator 76 is fed to a reset/switch controller 78 
which also accepts the watchdog error signal WDERR from the 
watchdog circuit 33 . 

15 Based upon the values of the watchdog alarm signal 

WDERR and that from the comparator 76, the reset/switch 
controller 78 provides an output signal RESET, available at 
the supervisory circuit output 80. Additionally, the 
reset/switch controller controls the switch 72, connecting 

20 the output 68 through the switch 72 to the VREG+ output 72 
so long as the output voltage from the regulator REGl is at 
least equal to the reference voltage VREF. Whenever the 
output from the regulator REGl falls below VREF, the 
controller 78 connects the output 70 of the regulator REG 2 

25 through the switch 72 to the output 74. In this manner, 
the supervisory circuit provides a backup regulated voltage 
supply from the regulator REG2 to the output 74 whenever 
the regulator REGl fails. The controller 78 also asserts 
the RESET output whenever the switch 72 is switched from 

30 one connection to another and includes power on reset 
circuitry which asserts the RESET, based upon the positive 
supply voltage V+, while power is being applied to the 
circuit 66. Power on reset circuits are known in the art 
and are discussed in Paul Horowitz, winfield Hill, The Art 

35 of Electronics , Cambridge University Press, New York, 1989, 
page 764. The watchdog alarm signal WDERR is also 
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available at the output 82 for use by other circuitry 
which may use it, for example, to disregard signals from 
the supervised circuit at any time the WDERR signal is 
asserted. 

5 The new supervisory circuit 66 of FIG. 6 may be 

employed within a microprocessor-based automotive control 
system 84 illustrated in the block diagram of FIG, 7. As 
described in the discussion of FIG. 6 , the supervisory 
circuit 66 accepts an unregulated input voltage v+ and 

10 provides a regulated output voltage VREG+. Additionally, 
the supervisory circuit 66 accepts a watchdog input WDIN 
from a microprocessor 86 and provides a watchdog alarm 
output WDERR which, in this implementation, is connected to 
a control circuit 88 . The microprocessor employs a monitor 

15 circuit 90 and control circuit 88 as intermediaries to 
monitor automotive functions, such as brake slippage, 
combustion efficiency, etc., and to control an anti-lock 
braking system 92 and an ignition system 94 . All the 
components 86-94 are supplied with regulated power from the 

20 supervisory circuit through output 74. The microprocessor 
86, control 88, and monitor 90 circuits additionally are 
connected to the reset output 80 for reset control. The 
watchdog alarm output 82 is connected to the controller 88, 
which is forced into a default state whenever the watchdog 

25 error alarm WDERR is asserted. This default state prevents 
errors from the microprocessor from propagating to the ABS 
92 and IGNITION 94 systems. 

The forgoing description of specific embodiments of 
the invention has been presented for the purposes of 

30 illustration and description. It is not intended to be 
exhaustive or to limit the invention to the precise forms 
disclosed, and many modifications and variations are 
possible in light of the above teachings. For example, use 
of the term microprocessor is not to be construed as any 

35 one type of microprocessor such as complex instruction set, 
reduced instruction set, von Neumann architecture, Harvard 
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architecture, etc. Furthermore, the term, in its use here, 
is meant to encompass microcontrollers, microcomputers, 
bit-slice controllers, and special -purpose controllers such 
as digital signal processors etc. The watchdog's minimum 
5 and maximum intervals may be adjusted when they are 
produced or subsequently by an original equipment 
manufacturer, for example. The clock may be internal to the 
watchdog circuit, or it may be provided by external 
circuitry. The combinatorial logic used in the preferred 

10 embodiment may be implemented in one of numerous 
interchangeable ways through use of logic transformation 
techniques such as Karnaugh maps, De-Morgan's laws, etc. 
The outputs and inputs of various components could be 
active low or active high with appropriate modifications of 

15 connected circuits . 

The embodiments were chosen and described in order to 
best explain the principles of the invention and its 
practical application, to thereby enable others skilled in 
the art to best utilize the invention. It is intended that 

20 the scope of the invention be limited only by the claims 
appended hereto. 
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I CLAIM: 

1. A watchdog circuit, comprising: 

a minimum interval detector (42) connected to receive a 
watchdog input signal from a monitored circuit and to determine 
whether intervals between assertions of the input signal are at 
least a minimum specified interval and to provide an indication of 
whether the intervals are the specified minimum, 

a maximum interval detector (34) connected to receive a 
watchdog input signal from a monitored circuit and to determine 
whether intervals between asssertions of the input signal are less 
than a maximum specified interval and to provide an indication of 
whether the intervals are the specified maximum, and 

combining circuitry connected to said minimum and maximum 
interval detectors to combine said indications to produce watchdog 
alarm output signal. 

2. The watchdog circuit of claim 1, wherein said combining cir- 
cuitry asserts said alarm signal whenever the interval between 
assertions of the watchdog input signal is less than a prescribed 
minimum interval or the interval between assertions of the watch- 
dog input is greater than a prescribed maximum interval. 

3. The watchdog circuit of claim 1, wherein said combining cir- 
cuitry asserts said alarm signal whenever the interval between 
assertions of the watchdog input signal is less than a prescribed 
minimum interval and the interval between assertions of the 
watchdog input is greater than a prescribed maximum interval. 

4. A watchdog circuit, comprising: 

a minimum interval detector (42) connected to receive a 
watchdog input signal from a monitored circuit, 

a maximum interval detector (34) connected to receive a 



WO 97/32282 



PCT/US97/03407 



17 

watchdog input signal from a monitored circuit, and 

an alarm output (WDERR), said minimum interval detector and 
maximum interval detector connected to assert said alarm output 
whenever the interval between assertions of the watchdog input 
signal is less than a prescribed minimum interval and the interval 
between assertions of the watchdog input is greater than a pre- 
scribed maximum interval. 

5. A watchdog circuit, comprising: 

a minimum interval detector (42) connected to receive a 
watchdog input signal (WDIN) from a monitored circuit and to block 
assertions of that signal whenever the interval between assertions 
of that signal is less than a prescribed minimum interval, and to 
pass those assertions whenever the interval between assertions of 
that signal is greater than or equal to the prescribed minimum in- 
terval, and 

a maximum interval detector (34) which includes an alarm 
output (WDERR), connected to receive assertions of said watchdog 
input signal from said minimum interval detector, said maximum 
interval detector connected to assert said alarm output whenever 
the interval between assertions of the signal from the minimum 
interval detector exceeds a prescribed maximum interval. 

6. The watchdog circuit of claim 5, further comprising a clock cir- 
cuit (36) connected to provide a pulsed clock signal to said minimum 
and maximum interval detectors, 

7. The watchdog circuit of claim 5, wherein said minimum interval 
detector (42) is connected to count clock pulses and to pass only 
those assertions of said watchdog input signal which are spaced at 
least a predetermined number of clock pulses apart. 

8. A supervisory circuit, comprising: 
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a watchdog circuit (33) including a minimum interval detector 
(42) having an input (WDIN), said input connected to receive a 
watchdog input signal from a monitored circuit and to block asser- 
5 tions of that signal whenever the interval between assertions of 
that signal is less than a prescribed minimum interval and to pass 
those assertions whenever the interval between assertions of that 
signal is greater than or equal to the prescribed minimum interval, 

a maximum interval detector (34) which includes an alarm 
1 0 output (WDERR), connected to receive said signal from said minimum 
interval detector, said maximum interval detector connected to 
assert said alarm output whenever the interval between assertions 
of the signal from the minimum interval detector exceeds a pre- 
scribed maximum interval, 
1 5 a clock circuit (36) connected to provide clock pulses to said 

minimum and maximum interval detectors, and 

a reset/switch (78) controller circuit connected to receive 
said watchdog output signal and to provide a reset output signal. 

9. A microprocessor based system, comprising: 
a microprocessor (86), 

a supervisory circuit (66) connected to receive a watchdog 
input signal (WDIN) from said microprocessor and to provide a 
5 watchdog alarm signal output (WDERR), 

said supervisory circuit comprising a watchdog circuit (33) 
including a minimum interval detector (42) having an input (WDIN), 
said input connected to receive a watchdog input signal from a mon- 
itored circuit and to block assertions of that signal whenever the 
1 0 interval between assertions of that signal is less than a prescribed 
minimum interval and to pass those assertions whenever the inter- 
val between assertions of that signal is greater than or equal to the 
prescribed minimum interval, and 

a maximum interval detector (34) which includes an alarm 
1 5 output (WDERR), connected to receive said signal from said minimum 
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interval detector, said maximum interval detector connected to 
assert said alarm output whenever the interval between assertions 
of the signal from the minimum interval detector exceeds a pre- 
scribed maximum interval. 

10. A method for producing a watchdog alarm signal, comprising the 
steps of: 

testing a watchdog input signal to determine whether asser- 
tions of it meet a minimum interval requirement, 
5 testing a watchdog input signal to determine whether asser- 

tions of it meet a maximum interval requirement, 

activating an alarm if the watchdog input interval violates 
either interval requirement. 
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